home *** CD-ROM | disk | FTP | other *** search
-
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
-
- INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
- How does it work? . . . . . . . . . . . . . . . . . . . . . . 1
- Some questions . . . . . . . . . . . . . . . . . . . . . . . . 2
- Quick initial installation . . . . . . . . . . . . . . . . . . 3
- TbFence demonstration . . . . . . . . . . . . . . . . . . . . 3
-
- USAGE OF TBFENCE . . . . . . . . . . . . . . . . . . . . . . . . . 5
- System requirements . . . . . . . . . . . . . . . . . . . . . 5
- Predefined configurations . . . . . . . . . . . . . . . . . . 5
- Program invocation . . . . . . . . . . . . . . . . . . . . . . 6
- Installation . . . . . . . . . . . . . . . . . . . . . . . . . 6
- De-installation . . . . . . . . . . . . . . . . . . . . . . . 7
- Status of diskette . . . . . . . . . . . . . . . . . . . . . . 7
- Encrypt a diskette . . . . . . . . . . . . . . . . . . . . . . 7
- Decrypt a diskette . . . . . . . . . . . . . . . . . . . . . . 8
- Options menu . . . . . . . . . . . . . . . . . . . . . . . . . 8
- Format to normal . . . . . . . . . . . . . . . . . . . . . . . 8
- Setup temporary gateway . . . . . . . . . . . . . . . . . . . 8
-
- ADDITIONAL INFORMATION . . . . . . . . . . . . . . . . . . . . . . 9
- Formatting diskettes . . . . . . . . . . . . . . . . . . . . . 9
- Bootable diskettes . . . . . . . . . . . . . . . . . . . . . . 9
- The TbFence.Sys device driver . . . . . . . . . . . . . . . . 9
- Viruses and Anti-Virus products . . . . . . . . . . . . . . . 9
- The encryption scheme . . . . . . . . . . . . . . . . . . . . 10
- Exit codes . . . . . . . . . . . . . . . . . . . . . . . . . . 10
- Error messages . . . . . . . . . . . . . . . . . . . . . . . . 11
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- INTRODUCTION
-
- Nearly every PC is equipped with one or more diskette drives. While a
- diskette drive is necessary for maintenance and upgrading, it may also
- be used to introduce malicious software into the system, copy software
- owned by the company, or even to export confidential information.
-
- Many companies have had unfortunate experiences with computer viruses,
- leaked information, or pilferage of software. For this reason many
- companies fiddle with diskless workstations, mechanical locks on the
- diskette drives, etc. While these measures prevent the introduction of
- malicious software or export of company properties, it is now also hard
- to transfer data from one desk to another, and to perform maintenance
- like upgrading software.
-
- TbFence was developed to solve these problems neatly. With TbFence you
- build a fence around your company or departments. Between the borders of
- this fence the data flow is not affected, but data can not cross the
- fence. A fence has a gate, and of course TbFence also offers you one.
- You may setup one workstation as a 'gateway' station. This gateway
- station can be used to import or export diskettes, of course under your
- control and after examination of the contents of the diskette!
-
-
- How does it work?
-
- TbFence is actually a transparent data encryption/decryption mechanism.
- Once you have installed TbFence, all data going to the diskette drive
- will be encrypted automatically, and all data read from the diskette
- drive will be decrypted as well. This background encryption and/or
- decryption is completely transparent to the user. If you don't tell the
- user, he will not even notice that something has been changed, until he
- tries to insert his unauthorized game diskette. TbFence will simply
- refuse to read from or write to this diskette. If the user copies
- information to a diskette, this diskette can be read on other machines
- equipped with TbFence, but when he tries to read the diskette at home,
- he will find out that it is impossible to read it. He is however still
- able to share the TbFenced diskettes with other employees of the compa-
- ny.
-
- +-----------------------------+
- | # | #
- | # TbFenced machines # | # The 'outside' world
- | |
- | #
- | # # |\gateway station
- | # |
- | # # | #
- | |
- +-----------------------------+
-
-
-
- 1
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- All machines between the TbFence borders can share diskettes, but to
- export diskettes to the 'outside' world, the diskettes have to pass
- through the 'gateway' station where they can be examined before allowing
- the conversion. The same applies to the import of diskettes. No diskette
- can enter the area within the 'fence' without autohorization by the
- gateway.
-
-
- Some questions
-
-
- By now some questions have probably entered your mind. Hopefully they
- will be answered by the sample questions listed below.
-
- Q: How can I import or export diskettes?
- A: The supervisor can temporarily override the settings of TbFence and
- allow it to use normal disks. You can also setup a permanent
- gateway station which can be used to convert diskettes, of course
- under control of the supervisor!
-
- Q: Are my employees able to remove TbFence?
- A: TbFence is installed on the master boot record of your hard disk.
- When you install TbFence you have to enter a password. You need to
- know this password when you want to remove TbFence. Low level disk
- utilities can not be used to remove TbFence.
-
- Q: What if the user boots from a non-authorized diskette?
- A: TbFence hides the partition information of your hard disk. If you
- boot from an unauthorized diskette the partition information is not
- available and the user is not able to access the hard disk.
-
- Q: What if I need to reboot from a diskette?
- A: You can reboot from a diskette if this diskette has been converted
- by TbFence, or when this diskette has been created on a TbFence
- machine. When you boot from such a diskette, the hard disk will be
- available, and the installed configuration of TbFence will still be
- applied, as if the user booted from the hard disk. So, if the user
- is normally not allowed to read normal diskettes, he is still not
- able to do so after a diskette boot. Remember, TbFence is complete-
- ly transparent to the user!
-
- Q: What if my employees install TbFence at their machines at home?
- A: The password you need to enter when you install TbFence is also
- used as an encryption key. This means that if the employees do not
- install TbFence with the same password as the TbFence on the compa-
- ny's PC, they still can't use the diskettes.
-
- Q: Once installed, can I remove TbFence from my system after the
- evaluation?
- A: Sure. You can remove TbFence from your system, leaving no trace, if
- you enter the correct password.
-
-
- 2
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- Q: What problems can I expect when using TbFence?
- A: Unlike some other 'Fence' products, TbFence has been implemented as
- very low level system software and works independent of the opera-
- ting system. Therefore TbFence is not affected at all by software
- like Windows, disk doublers, etc. It is very unlikely that you will
- ever encounter problems when using TbFence.
-
- Q: How does TbFence affect the performance of the machines?
- A: The encryption mechanism of TbFence performs very fast. You will
- probably not notice any decrease of speed. Also the memory require-
- ments of TbFence are very small: just 1000 bytes!
-
-
- Quick initial installation
-
- 1) Make sure you have a recent backup of your system.
-
- 2) Run TbFence and select 'Install' in the main menu. It is recommen-
- ded to setup a gateway station first, so select 'Gateway' in the
- installation menu. Enter a password when TbFence prompts you to do
- so. Make sure you don't forget this password as you will need it
- again when you want to remove TbFence from your system.
-
- 3) Reboot the system
-
-
- TbFence demonstration
-
- 1) TbFence is now active! Since the machine has been setup as a
- gateway station you are still able to read from and write to normal
- diskettes.
-
- 2) Take a formatted diskette and copy some files on it. Now startup
- the TbFence program and select 'Encrypt diskette'. After the
- conversion is completed return to DOS. Now use any DOS command you
- like, the diskette can still be used as usual. However, if you put
- this diskette into another machine without TbFence, you will see
- that it can't read that diskette.
-
- 3) Make a copy of your bootable system diskette and convert it as
- described above.
-
- 4) Now take another machine and install TbFence on it. Select 'crypto'
- in the installation menu. Enter the same password as you did on the
- 'gateway' machine. Reboot the system from the hard disk when the
- installation has been completed.
-
- 5) This machine is now a 'crypto' workstation, and it can only read
- from and write to encrypted diskettes. Put a normal diskette and an
- encrypted diskette into the drive: the encrypted bootable diskette
- will be readable, but the normal disks will not!
-
-
- 3
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- 6) Put a 'normal' system diskette into the machine and reboot. You
- will see that the harddisk can not be accessed after the reboot.
-
- 7) Put the encrypted system diskette into the machine and reboot
- again. You are now able to access the harddisk. You can still read
- encrypted diskettes and you have still no access to 'normal' ones.
-
- 8) If you are satisfied with the results you may want to register
- TbFence and install it on all your workstations. If you want to
- remove TbFence from your system, just run TbFence again and select
- 'Remove'.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 4
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- USAGE OF TBFENCE
-
-
- System requirements
-
- TbFence can be used on any machine with one or more diskette drives and
- a hard disk. There are no special system requirements. TbFence is
- compatible with Windows and disk doubler software. TbFence allocates one
- Kb of memory.
-
-
- Predefined configurations
-
- When you install TbFence on a system you can choose between five prede-
- fined configurations:
-
- Normal disks Encrypted disks
- read write boot read write boot
- ---- ----- ---- ---- ----- ----
- Secure No No No Yes No Yes
- Reader Yes No No Yes No Yes
- Crypto No No No Yes Yes Yes
- Importer Yes No No Yes Yes Yes
- Gateway Yes Yes Yes Yes Yes Yes
-
-
- Secure
-
- A machine configured as a 'secure' workstation can only read encrypted
- diskettes, and it can not write at all. If you don't want the user of
- the machine to use unautorized diskettes, and you want to be absolutely
- sure that no data can be exported from this system, you can configure it
- as a 'secure' workstation.
-
- Reader
-
- A machine configured as a 'reader' can read any diskettes, but never
- write. If you don't care what users put into their machines as long as
- they can not export information the 'reader' configuration might be what
- you are looking for.
-
- Crypto
-
- This is very likely the configuration you are going to install on most
- of the workstations. Machines configured as a 'Crypto' workstation can
- read from and write to encrypted diskettes, but they can't do anything
- at all with normal diskettes. If you use this configuration you do not
- affect the flow of data within your company, but you don't take the
- risks that people may introduce viruses or other malicious software, and
- you don't take the risk that confidential information will escape from
- the site.
-
-
- 5
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- Importer
-
- A machine configured as an 'Importer' is almost the same as a 'Crypto'
- workstation, but it is also able to read normal diskettes. An 'importer'
- machine is able to import information from outside the 'fence', but can
- still not be used to export information from within the 'fence' to the
- outside world. You don't have to perform special actions to switch
- between reading normal diskettes and encrypted diskettes: TbFence will
- automatically sense the diskette type and act accordingly.
-
- Gateway
-
- This configuration is intended for the supervisor. A 'gateway' station
- can read and write any diskette type, and diskettes can be converted in
- either direction. TbFence will of course automatically sense the type of
- diskette and act accordingly. This means that if you put an encrypted
- diskette into the drive TbFence will always write to this diskette with
- the encryptor enabled, and if you put a normal diskette into the drive
- the encryptor will be disabled automatically.
-
-
- Program invocation
-
- TbFence can be used either as a command line utility or menu driven. If
- you enter TbFence without command line options it will popup a menu
- shell. All command line options have corresponding menu items. You will
- probably prefer the menu shell of TbFence. The command line options are
- handy when you want to automate some TbFence actions in batch files.
-
- For an overview of command line options type:
- TbFence /help
-
-
- Installation
-
- Make sure you have a recent backup of your system. Invoke TbFence.
- Select 'Install TbFence' in the main menu. Select one of the five
- different types of workstations: 'Gateway', 'Importer', 'Crypto',
- 'Reader', 'Secure'. You can mix all configurations as long as you use
- the same installation password on every machine. TbFence will also ask
- you for a group name. You can enter anything you like, the groupname is
- not used by TbFence, but you may use it to identify the machine in case
- you want to setup separate "fence area's" in your organizations.
-
- Enter a password when TbFence prompts for it. You should use the same
- password on every machine within the 'fence'. Make a record of the
- password. You don't need the password anymore until you want to remove
- TbFence or change the configuration. When ready TbFence asks you to
- reboot. If you have a disk cache active with deferred writes, wait a few
- seconds to make sure the cache flushes before pressing Ctrl-Alt-Del.
-
-
-
- 6
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- Note: if you need to install TbFence on many machines, you will probably
- want to make a diskette with a batch file that uses the command line
- options of TbFence to automate the installation process.
- For more information type:
- TbFence /help
-
- Command line example:
- TbFence crypto password=secret
-
- This installs a crypto workstation with password 'secret'. If your
- password contains spaces you need to put the password between double
- quotes: password="this is secret".
-
-
- De-installation
-
- Make sure you have a recent backup of your system. Invoke TbFence.
- Select 'Remove TbFence' in the main menu. You have to enter the same
- password as when you installed TbFence. When ready TbFence asks you to
- reboot. If you have a disk cache active with deferred writes, wait a few
- seconds to make sure the cache flushes before pressing Ctrl-Alt-Del.
-
- Note: if you need to remove TbFence from many machines, you will proba-
- bly want to make a diskette with a batch file that uses the command line
- options of TbFence to automate the de-installation process.
- For more information type:
- TbFence /help
-
- Command line example:
- TbFence remove password=secret
-
- If your password contains spaces you need to put the password between
- double quotes: password="this is secret".
-
-
- Status of diskette
-
- TbFence is transparant to the user. This is probably exactly what you
- want, but it makes it also difficult to keep track which diskettes are
- encrypted and which not. If you select this option TbFence will tell you
- what kind of diskette is in the specified drive.
-
- Note: if you need to know inside a batch file whether a diskette is
- encrypted or not, you can use the 'query' command line option. You can
- test for the result using the DOS 'errorlevel' command. See also section
- 'Exit codes' of this manual.
-
-
-
-
-
-
-
- 7
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- Encrypt a diskette
-
- This option is of course only available on machines configured as
- 'importer' or 'gateway'. If you select this option TbFence will encrypt
- the diskette in the specified drive.
-
- Note: if you need to encrypt many diskettes you may want to create a
- batch file for this purpose. See also the example 'Encrypt.Bat' file in
- your TbFence directory.
-
-
- Decrypt a diskette
-
- This option is of course only available on machines configured as a
- 'gateway'. If you select this option TbFence will decrypt the diskette
- in the specified drive.
-
-
- Options menu
-
- If you select this menu item you will go to the TbFence 'options menu'.
- In this menu you can read the TbFence documentation and consult the list
- of TbFence agents. The two other options are listed below:
-
-
- Format to normal
-
- This option is only available on 'gateway' stations. By default, if you
- format a diskette on a TbFence machine, the diskette will be encrypted
- automatically. If you want to format a normal diskette you have to
- toggle this option. This option will be reset to its default value when
- you reboot the system.
-
-
- Setup temporary gateway
-
- If you want to temporarily override the configuration of a TbFence work-
- station, you can use this option. Of course you need to enter the
- correct password! Once you have selected this option the machine will
- act as a gateway station until the next reboot. Now you can import new
- software or export data without the need to convert the disks first.
-
-
-
-
-
-
-
-
-
-
-
-
- 8
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- ADDITIONAL INFORMATION
-
-
- Formatting diskettes
-
- If you format diskettes on a TbFence workstation they will be encrypted
- automatically. On a 'gateway' station you are allowed to override this
- default setting.
-
-
- Bootable diskettes
-
- Normal bootable diskettes can no longer be used to boot TbFence worksta-
- tions, except for gateway stations. For maintenance reasons however it
- would be a good idea to create TbFence bootable diskettes. There are two
- ways to create a TbFence bootable diskette:
-
- 1) Convert an existing bootable diskette using the 'Encrypt' option of
- TbFence.
-
- 2) Format a diskette on a TbFence workstation and use the DOS command
- 'SYS A:' to make the diskette bootable.
-
- The TbFence bootable diskette will now automatically load TbFence before
- passing control to the operating system. Once booted, the machine will
- behave as intended, so a 'Crypto' workstation will act as such, and a
- 'Secure' workstation is still not allowed to write to diskettes.
-
- Note: You can not use a TbFence bootable diskette to boot a machine
- without TbFence, as this would allow the 'foreign' machine to read the
- diskette.
-
-
- The TbFence.Sys device driver
-
- Normally you do not need the TbFence.Sys device driver. You will only
- need it when you use an ASPI driver as supplied by Adaptec. Put the
- following line in your Config.Sys file AFTER the ASPI driver invocation:
- Device=c:\tbfence\tbfence.sys
-
-
- Viruses and Anti-Virus products
-
- Viruses
-
- While using TbFence you have a good protection against computer viruses,
- as it is no longer possible for employees to introduce unauthorized
- software to the company's PCs. However, even the supervisor may make
- mistakes and introduce a virus into the system. If you have a file virus
- on your system, you should act as explained in the manual of your anti-
- virus package.
-
-
- 9
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- Bootsector viruses can still be introduced in the system. Although most
- employees will no longer introduces diskette to the company (as they
- know that their home diskettes can not be used anymore) it is of course
- still possible that a diskette contains a bootsector virus.
-
- Should a TbFence workstation get infected by a bootsector virus, try to
- boot from a TbFence bootable diskette. If this works, follow the clea-
- ning guidelines of your anti-virus product. However, should the TbFence
- loader report that the system is probably infected, it will refuse to
- boot. In this case the virus has written itself in front of the TbSetup
- loader. Boot the TbFence workstation from a NORMAL bootable disk (regar-
- dless of the TbFence configuration). Of course the hard disk is now not
- accessable, but this doesn't matter. Now clean the system as explained
- in the manual of your anti-virus product. After a reboot the system
- should work as usual.
-
-
- Anti-Virus products
-
- Due to the nature of TbFence, some anti-virus products may treat the
- TbFence loader as a virus. Contact your anti-virus vendor for support.
-
- Although most anti-virus products will behave correctly on a TbFence
- system, we recommend to use Thunderbyte Anti-Virus, as this anti-virus
- product is developed by us too, and therefore guaranteed to work in
- cooperation with TbFence. Please consult your TbFence vendor for more
- information.
-
-
- The encryption scheme
-
- As TbFence is designed as a transparant filter against unauthorized
- diskette transport within a company, it is not intended to be used as a
- data encryption tool against company spies. If you want to encrypt very
- confidential information you should not rely on the TbFence encryption
- alone, but use an adequate DES encryption scheme too.
-
- By default, TbFence will only encrypt the system areas of a diskette. If
- you want to use a full encryption scheme you can force TbFence to
- encrypt the complete diskette by using an asterisk (*) as the first
- character of the password. Keep in mind that in this case conversion of
- the disks will consume much more time. The resulting encryption scheme
- however will still not have the same degree of protection as a DES based
- encryption algorithm.
-
-
- Exit codes
-
- In command line mode TbFence exits with an exit code. You can use this
- exit code in batch files by using the errorlevel command. Consult the
- example Convert.Bat file for a detailed example.
-
-
- 10
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
- Only command line options 'encrypt', 'decrypt', and 'query' supply an
- exit code.
-
- query
- 1 The diskette is not encrypted
- 2 The diskette is encrypted
- 3 The diskette is encrypted but with another password
- 10 A disk read error occured
-
- encrypt/decrypt
- 1 The diskette was already decrypted
- 2 The diskette was already encrypted
- 3 The diskette was encrypted with another password
- 10 A disk read error occured
- 11 A disk write error occured
- 12 The diskette format is not compatible and can not be converted
- 255 TbFence not activated. Conversion aborted.
-
-
-
- Error messages
-
-
- While booting
-
- This is not a TbFence machine! You tried to boot from a TbFence
- bootable diskette on a system without
- TbFence.
-
- Non system disk! The diskette is not bootable. Use the
- DOS SYS command to make the diskette
- bootable.
-
- Security check failed! The security check of the TbFence
- loader failed. The system might be
- infected by a bootsector virus. Use
- an anti-virus product to find out.
-
- Unregistered evaluation version! You are using the evaluation version
- of TbFence. Once you have registered
- TbFence this message will not appear
- anymore.
-
-
- While installing TbFence
-
- Incompatible disk layout! Your disk has probably been partitio-
- ned by a DOS version below 3.0. Back-
- up your data, re-partition your sy-
- stem with a more recent DOS version,
- and restore the backup. Now you
- should be able to use TbFence.
-
- 11
- TbFence user manual (C) Copyright 1993 Thunderbyte B.V.
-
-
-
- While using the TbFence program
-
- Error: TbFence not activated! You have configured the machine as a
- gateway station and you booted from a
- normal DOS diskette. If this is true,
- reboot from a TbFence bootable dis-
- kette, or reboot from the harddisk.
- If the above is not true, you might
- need to use the TbFence.Sys driver.
- Check the 'TbFence.Sys' section in
- this manual for more information.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- 12